jacobmckenzie.dev
Dallas–Fort Worth, Texas

Incident leadership.
Infrastructure.
Tools I run in production.

I'm Jacob McKenzie. I lead major incidents, operate self-hosted infrastructure, and build tools for reliability and AI-assisted operations. My background includes seven years of enterprise IT experience, progressing from Tier 2 support into major incident leadership across manufacturing, banking, and payments.

Major incident command Self-hosted infrastructure Agentic AI operations Available for incident, SRE, and platform roles
Email RésuméLinkedInSee my work ↓
Professional experience

From enterprise support to incident command.

Enterprise support through TEKsystems, major incident leadership at 3M and Capital One, and incident-process design at Worldpay. My work spans technical coordination, ServiceNow workflows, executive communication, and post-incident follow-through.

Worldpay

Senior Incident Management Analyst

Worldpay · payments processingSep 2024 – Jun 2025
  • Designed and implemented ITIL 4-aligned Incident and Major Incident Management processes — workflow standards, escalation paths, stakeholder communications, and governance controls — giving a payments organization one documented path from detection to closure.
  • Translated those incident workflows into platform requirements and automations for an enterprise ServiceNow deployment, so the process shipped in the tool rather than in a document.
  • Built SLA-based Sev1/Sev2 prioritization models tied to business impact and enterprise criticality, so triage and restoration decisions were repeatable rather than case-by-case.
Capital One

Major Incident Manager

Capital One, via ICONMA · bankingJul 2022 – Jul 2024
  • Ran high-priority incident response around the clock across regulated financial-services infrastructure, AWS-hosted environments, and business-critical platforms.
  • Chaired incident bridges that put infrastructure, application, vendor, and business teams on one call, driving triage, escalation, mitigation, and restoration under a single owner and a single timeline.
  • Investigated service impact and tracked follow-through in ServiceNow, Splunk, New Relic, and Jira, so every incident closed with a record that named its impact and its outstanding actions.
3M

Major Incident Manager

3M, via TEKsystems · manufacturingJan 2020 – Jul 2022
  • Owned major incident response for enterprise manufacturing and business platforms end to end: clear ownership, validated impact, mitigation steps, and recovery communications.
  • Chaired cross-functional bridges through high-priority outages, keeping technical teams, leadership, vendors, and stakeholders working from the same picture of what was broken.
  • Closed the loop after restoration with post-incident reviews, RCA documentation, and corrective-action tracking, partnering with Problem Management so recurring faults were handled as problems rather than as repeat incidents.
7 yrsof enterprise IT support, incident response, and process improvement
24 × 7 × 365on-call coverage across regulated financial platforms
3 industriesmanufacturing, banking, and payments, under enterprise change control
Self-hosted infrastructure

I run a multi-host environment of roughly seventy services that family and friends rely on daily.

All public traffic enters through Cloudflare Tunnels and is governed by a single identity provider. I expose nothing without an explicit decision about who may reach it.

JM / InfrastructureService topology · front view

Application tier

Public services · tunnel edge

Source hosting, photo and document management, collaboration, search, and media services, published through a single tunnel origin.

Compute and AI

Operations console · local models

Overseer, local model serving, agent runtimes, and my Linux workstation, maintained entirely as code.

Network services

High-availability pair

DNS filtering, identity provider, secrets management, and TLS termination, replicated across two nodes with UPS monitoring.

Storage and backup

Resilience

Network storage over NFS / SMB, encrypted Borg backups with scheduled restore tests, and the documentation vault for the whole environment.

Logical layout · multiple physical hostsSelf-hosted / independently operated

Edge & identity

  • Cloudflare Tunnels as the only ingress; no inbound ports, operable behind CGNAT
  • Authentik SSO: OIDC, LDAP, and proxy outposts sharing the application's network namespace, so loopback is the trust boundary
  • Caddy as the ingress splitter, stripping client-supplied identity headers before any application receives them

Operations

  • Prometheus + Grafana, Scrutiny (SMART), PatchMon (patch posture), NUT (UPS)
  • Borg backups with restore tests; nightly update windows with agent-verified verdicts
  • Runbooks and service pages generated into an Obsidian vault and indexed for retrieval

Platform

  • Docker and rootless Podman, systemd units and timers, and Compose with pinned subnets
  • Self-hosted forges: Forgejo for code, pull requests, and CI runners; OneDev for issue tracking
  • MeshCore LoRa mesh nodes for off-grid messaging and telemetry
Public service status

Availability & uptime.

View public status

Loading public service availability…

OperationalDegradedOutageMaintenanceNo data

Source: Overseer public status. See availability and incident history.

Uptime covers observed service health; unknown periods are excluded. Public services shown here are a subset of my infrastructure.

AI systems

Agents with tools, evidence, and limits.

I build the systems around an AI model: orchestration, model routing, tool access, private retrieval, and evaluation. These are the practices I use in my own infrastructure.

Tools I work with

Claude Code Codex Gemini CLI GitHub Copilot Cursor Cline Windsurf Aider OpenHands Hermes Agent

01 / Agent orchestration

Give each agent a job and a way to work.

I configure the instructions, tools, and workflows around an AI model: the setup that turns a chat session into an agent that can complete a task.

  • Coding workflows: project instructions, hooks, reusable skills, and automated checks.
  • Delegation: divide work between agents with defined responsibilities and shared context.
  • Automated runners: run tasks without an open chat session, with isolated execution, budgets, and activity records.
Agent harnessesMulti-agent workflowsTask automation
02 / Model routing

Choose a model for the work in front of it.

I connect agents to a shared API and route requests according to task difficulty, cost, privacy, and availability.

  • Complex reasoning: more capable hosted models for architecture, investigations, and difficult code changes.
  • Routine work: smaller models for classification, summaries, drafts, and bulk processing.
  • Fallbacks: local routes for suitable tasks when a hosted service or its budget is unavailable.
OpenAI-compatible APIsOpenRouterCost controls
03 / Local inference

Run models on my own hardware.

I host local models for private knowledge searches, household data, and ongoing jobs, choosing models that fit the available hardware and workload.

  • Model serving: run 7B–27B models through Ollama and connect them to assistants.
  • Local and hosted together: let local assistants hand more demanding tasks to hosted models within permission limits.
  • Private processing: keep sensitive retrieval and embedding work on local infrastructure.
OllamaLlama & QwenLocal embeddings
04 / Tools & integrations

Connect agents to useful actions.

I build and integrate Model Context Protocol (MCP) servers: a common interface through which different agents can use the same tools.

  • Shared integrations: make tool servers available to several agents and clients.
  • Focused tool access: expose the tools a task needs to keep the agent's choices manageable.
  • Scoped permissions: separate read access from changes and keep secrets in environment references.
MCP serversAPI integrationPermission policies
05 / Retrieval & memory

Give answers a source and work a history.

I connect assistants to private notes and runbooks. Retrieval finds relevant material for the current question; shared memory carries useful context between tasks.

  • Knowledge retrieval: use embeddings to find notes by meaning and supply them as context.
  • Shared memory: preserve useful information across agents and sessions.
  • Source boundaries: separate read-only knowledge from the areas where agents may write.
Retrieval-augmented generationEmbeddingsPersistent memory
06 / Evaluation & controls

Check quality, access, and cost.

I test whether a workflow finds useful evidence and produces a supported result, while tracking what it can change and what it spends.

  • Retrieval checks: compare embedding models against a set of questions with known relevant sources.
  • Evidence and review: require supporting observations and human review for proposed operational changes.
  • Efficiency: use prompt caching, per-step token accounting, and smaller tool sets.
EvaluationAudit trailsToken budgets
A concrete evaluation

Testing whether a knowledge search finds the right notes.

I compared three embedding models using ten questions against my private knowledge base. The selected model returned a relevant source among its first three results for all ten questions. This is a check against my own material, useful for choosing a model for that workload.

See these practices in Overseer ↓
Selected projects

Tools I build and use every day.

Self-hosted systems I designed, built, and operate. A mix of public-source projects and private applications with public walkthroughs. Public repositories are on Forgejo: git.coolhole.net/aestheticjmack.

Contribution history

6,537 commitsForgejo · last 12 months · updated Oct 28, 2026
OctNovDecJanFebMarAprMayJunJulAugSepOct
MonWedFri
Daily commits across every branch of my Forgejo repositories, each counted once (UTC).Less More
13 projects
  • VaporOSPublic

    An Arch Linux + Hyprland desktop: Quickshell bars, a seven-mode launcher, Catppuccin Mocha over compositor blur. Scrubbed export of a per-machine configuration repo.

    arch-linuxcatppuccindotfileshyprlandqmlquickshellricewayland
    QMLScreenshots & write-up ↗InstallSource
  • VaporAgentPublic

    Self-hosted phone workspace for Codex, Claude Code and Hermes: follow each session as a conversation, approve permission prompts, get push notifications, and resume past work on your own machine.

    agentscodexhermespwaself-hostedtmuxvaporwave
    JavaScriptInteractive demo ↗InstallSource
  • VaporMemoryPrivate

    Self-hosted recall for AI agents over MCP: cited revisions, hash-checked reads, repeats sent as references per session, agent-drafted reviews a person confirms, and per-agent usage.

    recallmcpprovenance
    PythonTry the recall demo ↗What it will not do
  • Harvest BootPrivate

    Self-hosted boot media workbench: ISO library and release downloads, checksum verification, Ventoy USB profiles, QEMU boot testing, and netboot menu export.

    boot-mediaventoyqemu
    PythonTry the library demo ↗Architecture & decisions
  • OverseerPrivate

    Self-hosted operations center: inventory, probe agents, automatic incident filing and attribution, bounded AI investigation, approvals routed through Discord, and a public status page.

    opsincident-managementagents
    TypeScriptTry the incident demo ↗Architecture & decisions
  • LeyrPrivate

    Music requests, discovery and library management for Navidrome and Soulseek. Listening rooms with synchronized playback, party mode, Discogs collection links, share pages.

    musicnavidromesse
    TypeScript
  • DataChaffPublic

    An adversarial browsing agent that degrades the profiles data brokers build about you.

    adversarial-browsingdata-brokersplaywrightprivacypython
    PythonInteractive demo ↗Source
  • Anima09Public

    A bot population control plane, live world map, and operator UI for self-hosted 2009scape.

    2009scapebotsgame-serverkotlinself-hosted
    Kotlin
  • loopviewPublic

    A terminal visualizer and headless watchdog for Linux liquid-cooling loops.

    hardware-monitoringlinuxliquid-coolingpythonterminal-ui
    Python
  • romm-launchPublic

    Send games from RomM to real emulators on any paired machine.

    fastapipythonremote-launcherretro-gamingrommself-hosted
    Python
  • coolhole-searchPublic

    Answer cards, private engines, and a custom theme for a self-hosted SearXNG instance.

    pluginspythonsearch-enginesearxngself-hosted
    PythonLive site ↗
  • NirnPublic

    Mod management, validation, and config version control for hand-built OpenMW installations.

    mod-managermorrowindopenmwpythontes3mp
    Python
  • vaporwallPublic

    Per-monitor wallpaper curation, rotation, and animated starfields for Hyprland.

    gtk4hyprlandpythonwallpaperwaylandwpaperd
    Python
  • DomainGroupsPublic

    Automatic Chromium tab groups by domain, with stable favicon colors and manual overrides.

    browser-extensionchromium-extensionjavascriptproductivitytab-groups
    JavaScript
  • GlobeViewPublic

    A private, offline satellite-imagery new tab page for Chromium.

    browser-extensionchromium-extensionnew-taboffline-firstprivacysatellite-imagery
    JavaScript

ProjectsOverseer

Overseer · operations console

An operations console built from incident experience.

I built Overseer to bring inventory, monitoring, incidents, and investigation into one place. It collects evidence across my infrastructure, groups related failures, and gives me a record of what happened and what needs attention.

Try the incident demo Overview & screenshotsEngineering case study
Every collected fact carries its source, collection time, and freshness. Stale and failed data are first-class states, and missing data is never rendered as healthy: an unobserved check reads unknown, an agent that has stopped reporting reads stale, and a passing check with no running process behind it is excluded from the evidence.

The incident lifecycle I ran in enterprise operations — detect, attribute, mitigate, verify — implemented in software I operate daily. TypeScript, Node, React, and SQLite. Tested against a seeded test environment and operated on my own infrastructure. Read the case study for design decisions, validation, and current limits.

ProjectsHarvest Boot

Harvest Boot · boot media workbench

From an OS image to a tested boot drive.

I built Harvest Boot to keep operating system images organized, rescue drives current, and boot testing close at hand. One browser workspace brings together release downloads, checksum verification, Ventoy USB profiles, and QEMU virtual machines.

Try the library demo Overview & screenshotsArchitecture & decisions
HARVEST BOOT / LIBRARY → USB → VMIllustrative workflow · sample data
01 / Library

A curated rescue kit

Ubuntu Desktop, Debian, and SystemRescue, with image metadata and checksum records in one place.

Organise and verify images
02 / Ventoy

Preview the USB sync

A named profile selects the kit. Review additions and removals before copying anything to a drive.

Track files with a sync manifest
03 / Boot test

Check it in a browser

Launch a QEMU VM with BIOS or UEFI firmware and open its console through noVNC.

Test an ISO or a Ventoy drive
A boot drive is only useful if its contents are the ones you intended. Harvest Boot combines checksum verification, sync previews, and manifest-backed tracking so library management and USB preparation can be reviewed at each step.

Built with Python, Flask, SQLite, QEMU, and noVNC for a self-hosted, single-user workflow. The public demo recreates the grouped Library view with sample images, checksum filters, and expandable version details.

ProjectsVaporAgent

VaporAgent · your agents, wherever you are

Leave the desk.
Keep the work moving.

A self-hosted mobile workspace for Codex, Claude Code, and Hermes. Follow your agents, answer when they need you, and return to the same terminal on your desktop.

Try the interactive demo ↗Product overviewRun it yourself
01

See who needs you

Working agents and pending prompts in one view. Search projects, filter sessions, and open the terminal you need.

02

Pick up the same session

Check in from your phone, then reattach to the persistent tmux terminal when you return to your computer.

03

Run it on your own box

Portable Linux setup, your installed agent CLIs, and GNU GPLv3-or-later source. No homelab-specific setup.

Node.js · tmux · WebSocket · iPhone PWA · The public demo uses fictional sessions and never connects to private agents.

ProjectsDataChaff

DataChaff · noise for the profile they sell

They already have a file on you.
Fill it with noise.

A self-hosted browsing agent that walks a real browser through mutually contradictory people — a luxury shopper and a frugal retiree, a gun owner and an environmentalist — through the same tracking pixels your own browsing loads, until the record sold about your household stops agreeing with itself.

Watch a profile fall apart ↗Product overviewHow it works
01

Be several people at once

Twenty-five personas with their own interests, devices and hours. The ones that contradict each other share a cookie jar, so one identity holds beliefs that cannot all be true.

02

Feed the real stack

Every request is matched against a map of tracker domains, dozens of them belonging to the data brokers whose business is knowing you.

03

Measure it honestly

A weekly readback records which advertisers get served to a clean browser, and which tracker companies hold a cookie for each fake person.

Python · Playwright · SQLite · runs on a Raspberry Pi. It does not delete you from any database — it makes what they hold unreliable. AGPL-3.0-or-later. The product page covers the design, the measurements, and what it cannot do.

ProjectsVaporMemory

VaporMemory · recall an agent can be held to

A model will quote a stale note
with a straight face.

Self-hosted recall for the agents that run this homelab. Every answer names the exact source revision it came from and re-checks its hash before returning a word, so a note that changed underneath you is left out until it is re-indexed instead of being repeated with confidence.

Try recall in your browser ↗Product overviewWhat it will not do
01

Cite a revision, not a vibe

Results carry the source, heading and the SHA-256 of the file they came from, checked again at read time. Drifted, missing and expired sources are left out rather than served with a quiet caveat.

02

Useful and true are separate

A rating measures usefulness. A review is its own record naming the claims checked, the evidence and when it lapses — and an agent’s draft is corrected, then recorded under the agent’s name.

03

Send it once, show the working

Every retrieval records the query, the matched terms, the rank and the agent session that asked. A memory already sent to that session comes back as a reference, and VaporAgent shows each agent’s recall on its card.

Python · SQLite + FTS5 · local embeddings · MCP server for Claude Code, Codex and Hermes. It does not decide what is true: a matching hash proves the text is unchanged, never that it was right. GPL-3.0-or-later.

Correspondence · Window 01

Drop me a line.

Dallas–Fort Worth, Texas · Messages welcome from anywhere.

Personal correspondence / Air mailOpen for opportunities

Have a role or a project in mind? I’m open to incident management, site reliability, and platform operations opportunities, remote or in Dallas–Fort Worth.

[email protected] LinkedIn
— Jacob
Jacob McKenzie Incident Leadership, Infrastructure & Automation Dallas–Fort Worth, Texas Remote-friendly · US